ITEC FPX 5030 Assessment 5 Securing the Network and Creating an IPsec Tunnel

Name

Capella University

ITEC-FPX 5030 Emerging Technologies

Prof. Name

Date

ITEC FPX 5030 Assessment 5 Securing the Network and Creating an IPsec Tunnel

Executive Summary

Network security is essential for protecting local area networks (LANs), connected devices, and sensitive information from unauthorized access and cyberattacks. This lab uses Cisco Packet Tracer to explore network security concepts, including Internet Protocol Security (IPsec), Secure Shell (SSH), access control lists (ACLs), and switch port security. These technologies help administrators protect network communications, restrict remote access, and prevent unauthorized devices from connecting to network infrastructure.

The lab emphasizes how security configurations work together to strengthen network protection. SSH provides encrypted remote management, ACLs restrict access according to defined rules, and port security limits which devices can connect through designated switch ports. IPsec adds another layer of protection by authenticating and protecting IP traffic between supported network endpoints. Practicing these configurations in Cisco Packet Tracer helps develop practical networking skills and a better understanding of how multiple security controls contribute to a defense-in-depth strategy.

Introduction: Network Security Risks and Internet of Things Devices

The Internet of Things (IoT) connects physical devices, sensors, appliances, industrial equipment, and infrastructure through network technologies. Although IoT creates opportunities for automation and improved data sharing, it also expands the potential attack surface. Devices with weak passwords, outdated firmware, insecure communication protocols, or inadequate access controls can provide entry points for cybercriminals.

These vulnerabilities can affect individual users, businesses, healthcare organizations, industrial systems, and municipal infrastructure. A compromised device may expose confidential information, disrupt essential services, or allow an attacker to move deeper into a network. As organizations rely more heavily on connected technologies, they need effective security controls to protect information both during transmission and while systems are accessed remotely.

ITEC FPX 5030 Assessment 5 Securing the Network and Creating an IPsec Tunnel

IPsec is one technology used to protect IP communications. It supports authentication, integrity protection, and encryption when appropriate security settings are configured. IPsec can protect traffic between two hosts, between network gateways, or between a remote device and a protected network. Its flexibility makes it useful for virtual private networks (VPNs) and other environments that require secure communication across untrusted networks.

IPsec and Secure Sockets Layer (SSL)-based technologies are not interchangeable in every situation. Modern SSL VPN products generally use Transport Layer Security (TLS), while IPsec operates at the IP layer. The most appropriate option depends on the network architecture, supported devices, performance requirements, and security objectives. For IoT networks, IPsec can protect traffic between supported endpoints or gateways, while segmentation, device authentication, secure configuration, and monitoring provide additional safeguards (Raza, 2017).

IPv6 also supports IPsec, but its availability does not automatically make an IPv6 network secure. Administrators must configure appropriate security policies, authentication methods, encryption settings, and access restrictions. Effective network security therefore depends on the correct implementation of multiple complementary controls rather than on a single protocol.

Scope of the Network Security Lab

This lab uses Cisco Packet Tracer to practice essential network security configurations. The exercises focus on enabling secure remote administration, restricting management access through an access control list, and limiting unauthorized device connections through switch port security.

The lab covers three principal activities. First, SSH is configured to encrypt remote command-line management sessions. Second, an ACL is created and applied to control which IP addresses can access the switch remotely. Third, port security is configured on access ports to limit the number of permitted MAC addresses and define how the switch responds to security violations.

IPsec is the central topic of the assessment, but the listed procedures primarily demonstrate SSH, ACLs, and port security. These configurations are related network security controls; they do not, by themselves, establish an IPsec tunnel. A complete IPsec exercise would also require configuring compatible security policies, authentication credentials, encryption and integrity parameters, and tunnel endpoints.

Objective of the Lab

The primary objective is to understand how network security mechanisms can reduce the risk of unauthorized access and strengthen protection for a local area network. By completing the Packet Tracer exercises, learners develop practical experience with secure remote administration, access restrictions, MAC address controls, and the role of IPsec in protecting network traffic.

The lab also demonstrates why layered security is important. No single configuration can eliminate every threat, but combining secure management protocols, access control policies, port restrictions, and encrypted communications can significantly improve a network’s security posture.

Lab Resources and Requirements

Cisco Packet Tracer is the primary resource for completing the lab. The software allows learners to build a simulated network, configure switches and other network devices, and test whether security policies operate as intended.

The lab requires a switch that supports the relevant commands, an assigned hostname, appropriate IP addressing, and a reachable management interface. Depending on the simulated topology, a router or additional network devices may be necessary to test connectivity and remote access.

Procedure: Configuring Network Security in Cisco Packet Tracer

Step 1: Configure Secure Shell (SSH)

SSH provides an encrypted connection for remote administration of network devices. Unlike Telnet, which transmits session information without equivalent built-in encryption, SSH helps protect management credentials and command-line traffic against interception.

To configure SSH on a compatible Cisco switch, first assign the device a hostname and configure its management IP address. Configure the appropriate default gateway if remote management traffic must pass through another network. Verify connectivity by sending a ping from an authorized device.

Next, configure a domain name and an enable secret password. Create a local user account with appropriate privileges, then configure the virtual terminal (VTY) lines to accept SSH connections and use local authentication.

When prompted during RSA key generation, select an appropriate key size supported by the simulated device and the organization’s security requirements. The example credentials are placeholders and should be replaced with unique, strong credentials in a real environment.

The transport input ssh command restricts the configured VTY lines to SSH rather than allowing Telnet. The login local command tells the device to authenticate users against the local username database.

After configuration, verify SSH operation with commands such as show ip ssh and show running-config. From an authorized host, attempt to connect to the switch using an SSH client and confirm that authentication succeeds. If the connection fails, check the management IP address, reachability, RSA keys, local user credentials, and VTY configuration.

Step 2: Create and Apply an Access Control List

An access control list defines which traffic a network device permits or denies according to specified criteria. On a Cisco switch, a standard IPv4 ACL can restrict remote management access based on the source IP address.

In this example, 192.168.1.10 represents the IP address of the authorized management computer. Replace it with the correct address for the lab topology. Standard ACLs include an implicit deny at the end, so other source addresses that do not match a permitted entry will be denied.

 

Test SSH access from the permitted host and, where the simulation allows, from a different host that should be denied. Confirm that the ACL restricts remote management without interrupting authorized access.

An ACL should follow the principle of least privilege: permit only the users or networks that require access. In a production environment, administrators should also consider centralized authentication, management network segmentation, logging, and regular reviews of access permissions.

Step 3: Configure Switch Port Security

Switch port security helps limit the devices that can connect through designated switch access ports. It can reduce the risk of unauthorized devices being connected to unused or exposed network outlets.

Begin by selecting the relevant switch interface and configuring it as an access port. Enable port security, set the maximum number of permitted MAC addresses, and optionally enable sticky MAC address learning.

 

Repeat the configuration on each appropriate access port, adjusting interface names and permitted device counts to match the network design.

ITEC FPX 5030 Assessment 5 Securing the Network and Creating an IPsec Tunnel

The switchport port-security maximum 1 command limits the interface to one secure MAC address. Sticky learning allows the switch to learn a connected device’s MAC address and add it to the running configuration. Administrators should verify that the learned addresses correspond to authorized devices before saving the configuration.

Three commonly used violation modes are:

• Shutdown: Places the port into an error-disabled state when a security violation occurs, requiring appropriate recovery action.

• Restrict: Drops traffic from unauthorized MAC addresses and records the violation, with logging or counter behavior depending on the device.

• Protect: Drops traffic from unauthorized MAC addresses without the same level of notification provided by restrict mode.

The choice depends on the network’s security and operational requirements. Shutdown offers a stronger response but can interrupt legitimate connectivity if the port is configured incorrectly. Restrict provides visibility into violations while keeping the interface operational, whereas protect offers less diagnostic information.

After configuring port security, use commands such as show port-security and show port-security interface fastethernet0/1 to inspect the configuration and status. Test the policy in Packet Tracer and verify that the switch responds according to the selected violation mode.

Understanding IPsec and Secure Tunnel Configuration

IPsec is a suite of protocols that protects IP traffic through security services such as data integrity, peer authentication, and encryption. It is commonly used to create VPN connections between networks or between individual devices and network gateways.

Unlike SSH, which protects a remote management session, IPsec can protect selected IP traffic between configured endpoints. A typical site-to-site IPsec VPN requires compatible configurations at both endpoints, including the traffic to protect, peer addresses, authentication parameters, encryption and integrity algorithms, and security associations.

Internet Key Exchange (IKE) is commonly used to negotiate authentication and cryptographic parameters and establish the keys needed for IPsec communication. IPsec then protects traffic according to the negotiated security associations and configured policies.

ITEC FPX 5030 Assessment 5 Securing the Network and Creating an IPsec Tunnel

In Cisco Packet Tracer, the exact IPsec features and commands available depend on the simulated router model and software support. A complete tunnel lab should configure both endpoints and verify the negotiated security associations, tunnel status, and protected traffic. Commands such as show crypto isakmp sa, show crypto ipsec sa, or platform-appropriate equivalents may be available depending on the device and IKE version.

The SSH, ACL, and port security procedures described above strengthen network protection but do not independently configure or verify an IPsec tunnel. Keeping these functions distinct is important when documenting lab results and assessing whether the stated objectives have been met.

Security Testing and Verification

Testing confirms whether the configured security controls behave as expected. After completing the lab, verify SSH access from an authorized management host, confirm that the ACL denies unauthorized management connections, and test port security using the permitted and unpermitted MAC address scenarios supported by Packet Tracer.

For an IPsec tunnel exercise, also verify that both endpoints agree on the relevant security parameters and that traffic matching the protected policy passes through the tunnel. Where supported, inspect security association counters to determine whether protected traffic is being transmitted.

Testing should include both successful and unsuccessful access attempts. A successful connection demonstrates that an authorized workflow functions correctly, while a properly blocked connection demonstrates that a security restriction is being enforced. Any unexpected result should be investigated before the configuration is considered complete.

Conclusion

This Cisco Packet Tracer lab demonstrates how multiple network security controls can help protect a local area network against unauthorized access. SSH encrypts remote management sessions, ACLs restrict access to designated management interfaces, and switch port security limits the MAC addresses permitted to connect through access ports. IPsec complements these measures by protecting IP traffic between configured endpoints through authentication, integrity protection, and encryption.

The exercises also highlight the importance of configuration accuracy and verification. Administrators must test permitted and denied connections, inspect device status, and confirm that security settings do not disrupt legitimate network operations. Although the listed SSH, ACL, and port security procedures do not independently create an IPsec tunnel, they provide a useful foundation for understanding layered network defense and preparing for more advanced VPN configuration.

Frequently Asked Questions

What is the purpose of ITEC FPX 5030 Assessment 5?

ITEC FPX 5030 Assessment 5 focuses on network security concepts, including IPsec, SSH, access control lists, and switch port security. The lab uses Cisco Packet Tracer to explore how these controls protect network communications and restrict unauthorized access.

What is IPsec, and how does it improve network security?

IPsec is a collection of protocols that can authenticate network peers and protect IP traffic through integrity checking and encryption. It is frequently used in VPNs to secure communications between remote networks, gateways, or supported endpoint devices.

What is the difference between SSH and IPsec?

SSH secures remote administration sessions and other supported SSH-based communications. IPsec protects IP traffic between configured endpoints according to established security policies. SSH is commonly used to manage routers and switches, while IPsec is often used to establish secure network connections.

How does an access control list protect a Cisco switch?

An ACL applies permit and deny rules to traffic or management access. When an ACL is applied to a switch’s VTY lines, it can restrict SSH access to approved source IP addresses, helping prevent unauthorized hosts from managing the device.

What is switch port security?

Switch port security limits the MAC addresses permitted to use a configured switch port. Administrators can specify a maximum number of addresses, use sticky learning to record device addresses, and select a violation mode to determine how unauthorized connections are handled.

What are the three main port security violation modes?

The common modes are shutdown, restrict, and protect. Shutdown disables the affected port when a violation occurs, restrict drops unauthorized traffic and provides violation indicators, and protect drops unauthorized traffic with less notification.

Does configuring SSH and port security create an IPsec tunnel?

No. SSH, ACLs, and port security are separate security mechanisms. Creating an IPsec tunnel requires compatible configurations at both endpoints, including peer authentication, cryptographic settings, traffic selection, and the appropriate IKE and IPsec parameters.

How can an IPsec tunnel be verified?

Verification depends on the device platform and supported commands. Administrators can inspect IKE and IPsec security associations, check tunnel status, review packet counters, and test traffic that matches the protected policy. Successful connectivity alone does not always prove that traffic is being protected by IPsec.

References

Cisco Networking Academy. (n.d.). Cisco Packet Tracer. Cisco. https://www.netacad.com/cisco-packet-tracer

Cisco Systems, Inc. (n.d.). Cisco IOS security configuration guides. Cisco. https://www.cisco.com/c/en/us/support/ios-nx-os-software/ios-software-releases-12-4-mainline/products-installation-and-configuration-guides-list.html

Internet Engineering Task Force. (2005). Security architecture for the Internet Protocol (RFC 4301). RFC Editor. https://www.rfc-editor.org/rfc/rfc4301

Internet Engineering Task Force. (2006). Internet Key Exchange Protocol version 2 (IKEv2) (RFC 4306). RFC Editor. https://www.rfc-editor.org/rfc/rfc4306

Ranger, S. (2020). What is the IoT? Everything you need to know about the Internet of Things right now. ZDNET. https://www.zdnet.com/article/what-is-the-internet-of-things-everything-you-need-to-know-about-the-iot-right-now/

Raza, K. (2017). SSL or IPsec: Which is best for IoT network security? Network World. https://www.networkworld.com/article/3164531/ssl-or-ipsec-whats-the-right-approach-for-iot-network-security.html